Getting Data In

index future date events as today's date in _time

ayush1906
Path Finder

I am getting a future timestamped event, but I want to index it as default time of index. i.e. at the time when it got indexed.

Presently I have changed

MAX_DAYS_HENCE = 0

in my props.conf. But I found out that the event having tomorrow's date are getting index with tomorrow's date instead of today's date.

alt text

Like today its 23 July, I am looking for any events after today to be indexed for time 23 July. But in my case 24 July is taken as a valid date which should not be the case.

Any other workaround would be appreciated.

The source data is JSON response of API which I am indexing via python script and taking PED field as _time

0 Karma
1 Solution

adonio
Ultra Champion
0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...